@desplega.ai/agent-swarm@2.7.10
agent-swarm.dev — an open-source operating system for AI work: a lead agent breaks goals into tasks, routes them to specialized workers such as Claude Code or Codex, runs each worker in an isolated container, and preserves shared memory, tools, schedules,
AI Security Review
scanned 19h ago · by lpm-firewall-aiThe package sends identifying organization and user context to its vendor's telemetry endpoint, enabled by default. Under the review rules this is suspicious telemetry, not a basis for a publish block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Starting the HTTP API server when telemetry is enabled by default.
Impact
The vendor receives organization and user identifiers through analytics events; no credential theft or unrelated file collection was identified in this path.
Mechanism
The server initializes telemetry, builds event payloads containing organization and actor identity fields, and POSTs them to the vendor endpoint. ANONYMIZED_TELEMETRY can disable this.
AI rationale
The package sends identifying organization and user context to its vendor's telemetry endpoint, enabled by default. Under the review rules this is suspicious telemetry, not a basis for a publish block.
Evidence
src/telemetry.tssrc/be/telemetry-enable.tssrc/http/index.ts
Network endpoints1
proxy.desplega.sh
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- Runtime telemetry defaults on and can be disabled with ANONYMIZED_TELEMETRY.
- HTTP server startup initializes telemetry and generates an installation ID when one is absent.
- Telemetry context includes organization details, an installation ID, and an actor user ID.
- Telemetry events are POSTed to the vendor endpoint at proxy.desplega.sh.
Evidence against
- The reviewed telemetry path sends analytics context; no credential or file-content transfer was identified in that path.
- The telemetry has an opt-out setting.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedTelemetryUrlStrings
WildcardDependency
Source & flagged code
17 flaggedtemplates/skills/qa-loom/files/build-loom.mjsView file
5// Needs: Node 18+ (global fetch, top-level await) and ffmpeg built with libass (`ass` filter).
L6: import { execFileSync } from "node:child_process";
L7: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
High
Child Process
Package source references child process execution.
templates/skills/qa-loom/files/build-loom.mjsView on unpkg · L5src/tests/swarm-diff.test.tsView file
184// `CustomEvent`, and `queueMicrotask` — provide each as a free variable.
L185: const factory = new Function(
L186: "window",
High
Eval
Package source references dynamic code evaluation.
src/tests/swarm-diff.test.tsView on unpkg · L184src/script-workflows/harness.tsView file
Findings
4 Critical8 High9 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/http-5a9p4h6y.js
CriticalCredential Exfiltrationdist/cli-j7d73g1y.js
CriticalTrigger Reachable Dangerous Capabilitydist/http-5a9p4h6y.js
CriticalPrevious Version Dangerous Deltadist/cli-8ewkreqd.js
HighChild Processtemplates/skills/qa-loom/files/build-loom.mjs
HighShell
HighEvalsrc/tests/swarm-diff.test.ts
HighSame File Env Network Executiondist/http-5a9p4h6y.js
HighCredential Redirect Persistencedist/cli-fsgttth8.js
HighCross File Remote Execution Contextdist/cli-36wdfzgn.js
HighTrigger Reachable Credential Exfiltrationdist/cli-j7d73g1y.js
Affected versions and remediation
This report applies to @desplega.ai/agent-swarm@2.7.10.
See all versions of @desplega.ai/agent-swarm for other recorded verdicts.
- Review the evidence and your use of @desplega.ai/agent-swarm@2.7.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.